3993 matches found
Microsoft Windows 7 (x86) - (BlueKeep) RDP Remote Windows Kernel Use After Free Exploit
EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47683.zip import rdp import socket import binascii import time def poolsprays, crypter, payload: times = 10000 count = 0 while count times: count += 1 print'time through %d' % count try:...
ImageMagick < 7.0.9-0 Denial of Service (DoS) Vulnerability - Windows
ImageMagick is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-18853
CVE-2019-18853 entry is rejected/not used; it does not represent an active vulnerability.
EulerOS 2.0 SP3 : cairo (EulerOS-SA-2019-2268)
According to the version of the cairo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service out-of-bounds read because of mishandling o...
CVE-2019-12918: Improper Neutralization of Special Elements used in an SQL Command
Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is softwarelibrary.php and affected parameters are order0column and order0dir...
PT-2019-13111
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description The issue allows an authenticated user to execute arbitrary commands against the database due to SQL injection. The affected component is "/userui/ticket...
PT-2019-13020
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order0column and order0dir...
CVE-2019-13076: Improper Neutralization of Special Elements used in an SQL Command
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...
offcampushousing.unc.edu Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1007421 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium
Executive summary Kaspersky Exploit Prevention is a component part of Kaspersky products that has successfully detected a number of zero-day attacks in the past. Recently, it caught a new unknown exploit for Google's Chrome browser. We promptly reported this to the Google Chrome security team...
New Chrome 0-day Bug Under Active Attacks – Update Your Browser Now!
Attention readers, if you are using Chrome on your Windows, Mac, and Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today. With the release of Chrome 78.0.3904.87, Google is warning billions of users to install an urgent...
CVE-2019-17551: Improper Neutralization of Input During Web Page Generation
In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...
PT-2019-15201
Name of the Vulnerable Software and Affected Versions Apak Wholesale Floorplanning Finance versions 6.31.8.3 through 6.31.8.5 Description The issue allows an attacker to send an authenticated POST request with a malicious payload to "/WFS/agreementView.faces" which enables a stored XSS via the...
Tracking CVE-2019-11043 PHP Vulnerability – An Uncommon Chain of Events
On October 22, security researcher Omar Ganiev published a tweet regarding remote code execution vulnerability in PHP-FPM the FastCGI Process Manager running on the Nginx server. The tweet includes a link to a GitHub repository with an explanation of the vulnerability and a PoC proof-of-concept f...
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management
Summary There are vulnerabilities in Node.js used by IBM® Cloud App Management. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID: CVE-2019-9513 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Resource Loop...
java-1.8.0-openjdk security update
1:1.8.0.232.b09-0 - Update to aarch64-shenandoah-jdk8u232-b09. - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:1.8.0.232.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u232-b08. - Resolves: rhbz1753423...
Security Bulletin: Vulnerability in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows(IBM SDK, Java Technology Edition Quarterly CPU - Jul 2019 - Includes Oracle Jul 2019 CPU) )
Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the following vulnerabilities:CVE-2019-4473,CVE-2019-11771. These issues were disclosed as part of the IBM Java SDK updates in July. 2019. Vulnerability Details Third Party Acknowledgement Info: None Relevant CVE Information:...
PT-2019-5847 · Imagemagick +5 · Imagemagick +5
Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.9-0 Description: A flaw was found in ImageMagick in coders/bmp.c, related to an integer overflow of the value. This could allow a remote attacker to cause a denial of service using a specially crafted file. T...
PT-2019-5850 · Imagemagick +4 · Imagemagick +4
Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.9-0 Description: The issue is related to an integer overflow in the MagickCore/quantum-private.h component of the ImageMagick console graphic editor. This allows a remote attacker to cause a denial of service...
Apple iTunes and iCloud for Windows 0-Day Exploited in Ransomware Attacks
Watch out Windows users! The cybercriminal group behind BitPaymer and iEncrypt ransomware attacks has been found exploiting a zero-day vulnerability affecting a little-known component that comes bundled with Apple's iTunes and iCloud software for Windows to evade antivirus detection. The vulnerab...